PT-2019-13748 · Espocrm · Espocrm

Gauravnarwani97 · Published 2019-08-05 · Updated 2019-08-09 · CVE-2019-14550

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.9

Description The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires when a user clicks on the Edit Dashboard button, allowing the attacker to steal victims' cookies and compromise their accounts.

Recommendations For versions prior to 5.6.9, update to version 5.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Edit Dashboard feature until the update is applied. Avoid using the add tab list feature in the Edit Dashboard until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14550

Affected Products

Espocrm

References · 6

• 🔥 https://github.com/espocrm/espocrm/releases/tag/5.6.9 · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5 · Exploit
• 🔥 https://github.com/espocrm/espocrm/issues/1369 · Exploit
• 🔥 https://gauravnarwani.com/publications/cve-2019-14550 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14550 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14550 · Vendor Advisory